SM,
I cannot tell what "SAFE" is. That is not explained in the
Introduction or in the following paragraphs.
In the title is expand the acronym as follows:
SAFE (Server-side Asynchronous Framework Execution) Scripting Method
The introduction states that SAFE Scripting Method is a model. The
model is expanded later in the document. I could be more clear about
the definition in the introduction section.
The third requirement in the draft is for a certificate
authority. That can be a hurdle in terms of adoption.
The CA requirement is necessary to verify the distant server is not on a
spoofed domain. I have not found an alternative method of credential
verification.
Script execution in email has proven to be problematic. Although it
is done on the server side, that does not reduce the risks as you
still face the upgrade issue as the servers do not get updated that
often.
I don't see this as a problem. If the server that owns a script is the
same point as the execution of that script then the author of the code
owns its problems. That requires the owner of code to take
responsibility for the results of script code they maintain, which is
not a requirement on the web.
Could you please explain what this proposal has to do with SMTP?
This proposal is inherently reliant upon intermediary agents to execute
script code in accordance with model defintions in RFC 5598.
A security centered document generally has some security
considerations.
The document is itself a security consideration, but I think I will take
your advise and actually specify the problems of the WWW that this is an
alertnative for.
Digital certificates by themselves do not have any credibility for
some types of users.
The digital certificate should not carry any credibility by itself, but
should instead serve as a vessel for a digital signature.
Thanks,
Austin